Do you offer a free cybersecurity assessment for my startup?
Key takeaways
- Every prospective client gets a free 30-minute scoping call; early-stage startups get that call extended into a free initial exposure review.
- The free review covers your public-facing attack surface, not your application internals, so it will not find a business logic flaw.
- It produces no formal report and no certificate, because it is an orientation rather than an assessment.
- The output is a written scope with a fixed price band and a delivery date, so you can compare it against other quotes on equal terms.
- A free assessment that ends with a hard close is worth more than one that ends with a vague promise to send details later.
As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.
What is actually included in the free review?
Four things. First, your public attack surface: every domain you own, what is exposed on it, and how that changes over time. Second, your dependency stack, checked against known advisories, because most startup breaches are a dependency and not a novel bug. Third, your account recovery configuration, which is where a single compromised email address usually leads to a full account takeover. Fourth, a short conversation about what you are actually protecting and what a serious failure would cost you. It takes about 45 minutes and it produces a written scope.
What is not included, and why?
No application testing, no authenticated access, no source review and no report. Those require a testing window, a rules-of-engagement document and signed authorisation, and doing them for free would mean doing them badly or doing them without proper consent. The exclusion is deliberate. A free engagement that quietly becomes a real engagement without a scope and a signature creates exactly the authorisation ambiguity that makes the whole profession untrustworthy.
How do I prepare for the scoping call?
Bring four things: a list of the applications and domains you own, the number of distinct user roles in each, whether you handle payments or customer personal data, and your deadline. That is enough for a genuinely useful conversation. You do not need to prepare documentation, and you do not need a readme. If you have a recent incident, bring the timeline, because it usually changes the scope entirely and often makes the first engagement smaller and more urgent.
What happens after the free assessment?
You get a written scope naming the systems, the tester-days, the price band, the delivery date and the retest policy, plus a rules-of-engagement document for both sides to sign. That document is what makes the engagement lawful and it is what protects you if anyone later questions what was tested. If the scope does not suit you, keep it. A written scope is useful even when you buy the work elsewhere.
| Review area | Covered in the free review | Not covered, and why |
|---|---|---|
| External footprint | Public domains and exposed services | Application internals, which need a testing window and signed authorisation |
| Dependencies | Dependency stack against known advisories | A penetration test, which is a paid engagement with a report and a retest |
| Account recovery | Account recovery configuration | Authenticated testing, which requires a rules-of-engagement document first |
| Scoping | A short conversation about what you are protecting | A formal report or certificate, because it is an orientation rather than an assessment |
What are the frequently asked questions?
Get a straight answer on this
Book the free 30-minute scoping call and bring your domain list, your user roles and your deadline.
Send us the details See pricing